After reading one of the references (https://money.cnn.com/2015/10/16/technology/sniper-power-gri...), and learning that they think it might have been an insider, a third possibility occurs to me: what if it was someone—maybe a PG&E employee—who knew first-hand how unprotected this infrastructure was, and wasn't being taken seriously? Especially given the Homeland Security report a year earlier about how easy this kind of attack would be.
Conspiracy-theory stuff, maybe, but:
> The assault...became a harsh wake-up call for energy providers, who have since become obsessed with the physical security of their remote power stations.
> PG&E alone has pledged to spend $100 million to improve security at its facilities...Transformers are often custom designed, sometimes costing $3 million each—and replacements are slow. Plus, physical attacks on energy distribution machines are much more effective at taking out the power grid than a computer hack. And it's incredibly easy to pull off, several energy utility firms told CNNMoney.
> Experts attending GridSecCon, held by the North American Electric Reliability Corporation this week, are now discussing the need to enclose electronics in 1/2-inch thick armor plating that can stop high-powered rifle rounds. Power utilities have started loading remote substations with infrared cameras, gunshot audio sensors and even seismic recorders that catch vibrations.